Insider Attacks and the Disturbance they can cause

1. Insider Attacks and theDisturbancethey can cause Presented by: AVATAR Rajesh Augustine, Marek Jakubik, Rao Pathangi, and Jonathon Raclaw

2. Impact on Confidentialitydue to Insider Attacks Definition: An insider is anyone with special or additional access to an organization's protected assets and an insider attack is someone using that access to violate protocol or cause harm intentionally or unintentionally to the organization in any form. (Protocol violations with good intentions are still considered threats).

3. Who are the Inside Attackers? • Insiders range from 18 to 59 years of age [3] • Half are female [3] • Insiders came from a variety of racial and ethnic backgrounds, and were in a range of family situations with around 55% single [3] • Insiders were employed in a variety of positions within their organizations, including service (31%), administrative/clerical (23%), professional (19%), technical (23%)

4. Who are the Inside Attackers? • Only a forth of the insiders are employed in technical positions and with a very small percentage possessing system administrator/root access within the organization. • The reality is that about a half is not even unaware of the organizations’ technical security measures.

5. Possible Insider Threat Example 1 – A Telecommunications Company • Any employee with a valid login and password, which is confirmed using LDAP, can access 98% of all field test Quality Data from current products in development. • An attacker can see how well current releases are performing in comparison to earlier versions as well as other releases from other products. • With a little work they can get a list of all phone numbers from all handsets that are currently in the field. • Along with the phone numbers is also a list of Cellular Providers, from which messages are being received. Besides indicating which handsets are in development for which providers, this collection of data could be used to identify individuals (through the use of reverse telephone look-ups) to ultimately get their hands on the actual testing prototype(s) currently testing in the field.

6. Example 2 – A Credit Card Company Credit card information needs to be transmitted over the network securely to complete the authorization from the point of sale to our company’s servers and back to point of sales terminal. Our company implemented PCI standards to make this communication secure so that Trudy’s will not get hold of this customer’s sensitive credit card information. Customer’s personal information and credit card information should not be disclosed to any third person and kept in a secure way within our company’s systems. So our company has instituted strict guidelines for sending this information over the e-mail system and also handling this information within the company. Employees still send real card numbers in plain text format to one another. Employees also leave the print outs with account numbers from different application’s screen prints or reports by the printer. Possible Insider Threat

7. Example 3 – A Different Credit Card Company An insider who worked for a credit card point-of-sale terminal vendor used social engineering to obtain authentication information from the credit card company help staff [3] The insider posed as a distraught individual (with a fabricated identity) working for a particular, authorized merchant needing help with a malfunctioning terminal. He was then able to credit his own credit card by reprogramming a terminal using the information he had obtained. Possible Insider Threat

8. Example 4 – A Healthcare Company Patient care typically involves information exchange between a large number of individuals providing services in a hospital, mostly through a combination of electronic and paper records. Unintentional unauthorized access is rampant in Healthcare sector. Patient data is prone to insider threats by acts of negligence. Transcription services involve speech (recorded by doctors) to text conversion by humans, leaving room for errors. Report validation efforts are either minimal or simply do not exist. Due to outsourcing, patient information is being accessed in countries which may not have strong “safe harbor” policy enforcement. Insiders in these countries can hold data at ransom or threaten to disclose sensitive medical information. Possible Insider Threat

9. Numbers… • 39% of respondents report 20%+ of their organizations' financial losses are from insider attacks. [7] • 7% estimate that insiders account for 80% of their financial losses. [7] • Insider attacks account for 80% of all computer and Internet related crimes [1] • 70% of attacks causing at least $20,000 of damage the result of insider attacks [1]

10. Pros and Cons of Existing work Pros • Companies have come up with policies and procedures to address the issue • Fear of getting caught and fired if information is leaked helps to some extent • Policies of insider threats have been solidified, giving rise to the intersection of Law and IT. • Monitoring has become sophisticated as monitoring systems now employ AI algorithms to detect insider attacks. Cons • With the ease of access to information, an individual with malicious intent can compromise quickly • Sometimes even though the policies and procedure exists it is not strictly enforced • Focus has been devoted to addressing "outsider" threats thus the study of "insider threats" is very much in its infancy. • Insider Threat prevention does not match the evolution of work which now include social networking, Open Source, etc.

11. Conclusions • Insider threat is real – deserves same attention as “outsider” threats. • Insider threats are relatively low-tech but the impact can be deadly. • Definitions of “Insider” and “Insider Threat” are still evolving. • Threats due to “logic bombs” in IT systems are very hard to detect; highlights the importance of code reviews and quality control. • Complexity and scale of problem heightened by social networking, outsourcing, mobile computing, and open source • Policies and procedures are being drafted and implemented in companies to counter an insider attack. The legal aspects of the threat have gained a semblance of structure. • Organizations are pooling resources to draft best practices for the vertical they belong to. PCI-DSS is a good example.

12. Questions?

13. References [1] Jim Carr. Strategies and issues: Thwarting insider attacks, 2002. [2] Nathan Einwechter. The enemy inside the gates: Preventing and detecting insider attacks, 2002. [3] National Threat Assessment Center - Insider Threat Study, http://www.ustreas.gov/usss/ntac_its.shtml [4] Jason Franklin, Parisa Tabriz, and Matthew Thomas. A Case Study of the Insider Threat through Modifications to Legacy Network Security Architectures, unpublished manuscript. [5] NetworkWorld, VA breach shows growing insider threats http://www.networkworld.com/columnists/2006/061906-insider-threats.html [6] Data Security Breaches in Healthcare Industry Must Be Contagious http://blog.redemtech.com/2009/04/data-security-breaches-in-healthcare-industry-must-be-contagious-.html [7] Information Week, How To Spot Insider-Attack Risks In The IT Department http://www.informationweek.com/news/security/cybercrime/showArticle.jhtml?articleID=196602853